About configuration files

Splunk Enterprise configuration information is stored in configuration files. These files are identified by the .conf extension and hold the information for different aspects of your configurations. These aspects include:

Most configuration files come packaged with your Splunk software in the $SPLUNK_HOME/etc/system/default/ directory.

Use Splunk Web to manage configuration files

When you change your configuration in Splunk Web, that change is written to a copy of the configuration file for that setting. Splunk software creates a copy of this configuration file (if it does not exist), writes the change to that copy, and adds it to a directory under $SPLUNK_HOME/etc/.... The directory that the new file is added to depends on a number of factors that are discussed in Configuration file directories in this manual. The most common directory is $SPLUNK_HOME/etc/system/local, which is used in the example.

If you add a new index in Splunk Web, the software performs the following actions:

1. Checks for a copy of the file.

2. If no copy exists, the software creates a copy of indexes.conf and adds it to a directory, such as $SPLUNK_HOME/etc/system/local.

Edit the configuration file settings directly

While you can perform a lot of configuration with Splunk Web or CLI commands, you can also edit the configuration files directly. Some advanced configurations are not exposed in Splunk Web or the CLI and can only be changed by editing the configuration files directly.

Important: Never change, copy, or move the configuration files that are in the default directory. Default files must remain intact and in their original location. To change settings for a particular configuration file, you must first create a new version of the file in a non-default directory and then add the settings that you want to change. When you first create this new version of the file, start with an empty file. Do not start from a copy of the file in the default directory. For information on the directories where you can manually change configuration files, see Configuration file directories.

Learn about the structure of the stanzas that comprise configuration files and how the attributes you want to edit are set up. See Configuration file structure.

Learn how different versions of the same configuration files in different directories are layered and combined so that you know the best place to put your file. See Configuration file precedence.

Consult the product documentation, including the .spec and .example files for the configuration file. These documentation files reside in the file system in $SPLUNK_HOME/etc/system/README, as well as in the last chapter of this manual.

After you are familiar with the configuration file content and directory structure, and understand how to leverage Splunk Enterprise configuration file precedence, see How to edit a configuration file to learn how to safely change your files.

Comments

Sideview -

Thanks for alerting us to this issue. I've updated the material to address the problem.

Sgoodman, Splunker

December 15, 2015

Addendum to my comment -- of course, what's written here is perfectly fine if the user never upgrades splunk ever. But as soon as there's a new splunk release the net effect of the fossilized default file now sitting in local is a big unknown and I've seen it cause both problems and confusion.

Sideview

December 14, 2015

"Do not edit a default configuration file directly. Instead, create a copy and place it in a different directory, the same way Splunk Web does."
This is a super dangerous thing to tell users to make a copy of the entire default file, because now all those stanzas and keys they are copying will override default forever.

What the docs should say is basically "never edit default but instead just add just the stanzas and keys that you need to add/override, to the local file"

Sideview

December 14, 2015

Arpoador, there are several topics in this manual specifically to help Windows customers. See http://docs.splunk.com/Documentation/Splunk/latest/Admin/IntroductionforWindowsadmins for information and navigation to the topics you need.

Cgales splunk

October 30, 2013

Just for fun, assume the user isn't using Linux. Update the doct't to indicate that for the two people using Splunk on Windows, we should look in "Program Files>Splunk>etc>system>local".<br />Sorry for being testy, but I'm running into a storm of poorly thought-out doct'n and it's consuming my whole day to get basic info as I stumble through stuff that should be easy. Eventually I'll learn it, but it won't be because of the Documentation.<br />Thanks. Dave. 650.678.1442

About configuration files

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »